With the assistance of Server management services from Skynats, let’s examine the cloudflare ntp amplification attack in more detail and how it affects your systems.
Network Time Protocol
The Network Time Protocol (NTP) synchronizes time among computer systems with variable-latency and unpredictable network connections.
Using the global Anycast network, we can synchronize time with the nearest server. We can accomplish this by utilizing the NTP provided by Cloudflare, which is free to use.
What is an NTP amplification attack?
During an NTP amplification attack, a malicious user will try to take advantage of a flaw in the Network Time Protocol (NTP) server.
When a server or network is the target of a reflection-based volumetric distributed denial-of-service (DDoS) attack, more UDP traffic is sent to the target, blocking access from other networks and infrastructure.
What is an NTP amplification attack?
There is a difference in bandwidth costs between the attacker and the targeted online resource in every amplification attack.
The network infrastructure may be affected by the volume of traffic that develops when the cost disparity is multiplied across numerous queries.
By submitting brief queries that receive enormous amounts of information, the malicious user can get more out of less. The attacker can avoid detection and gain access to a much higher attack volume by multiplying this amplification and having every bot in a botnet send similar requests.
The NTP Amplification Attack: Four Steps:
- Using the monlist command, an attacker chooses an NTP server as a target. Then uses a botnet to send UDP packets with fake IP addresses. The spoof IP address of each packet points to the real IP address of the victim.
- The monlist command is used in every UDP packet to send a request to the NTP server, which then produces a substantial response.
- The server then responds to the spoofed address with the generated data.
- When the response is sent to the target’s IP address, the surrounding network infrastructure is overloaded and suffers denial of service.
It is difficult to reduce this attack traffic without interfering with legitimate activity on real NTP servers. This is due to the attack traffic appearing to be genuine communication coming from trustworthy servers.
Without verifying the legitimacy of the request, the NTP server will send the targeted server meaningful responses. This is because there is no need for a handshake with UDP packets.
Due to these aspects and a built-in command that by default generates a large response, NTP servers make excellent reflection sources for DDoS amplification attacks.
Conclusion
In conclusion, with the help of our tech support team, we have realized more about the Cloudflare NTP amplification attack and its effects on user systems.
Are you looking for an answer to another query? Contact our technical support team.
